SmarterTools SmarterMail up to 9560 HTML Sanitizer message-iframe HTML injection

Summaryinfo

A vulnerability was found in SmarterTools SmarterMail. It has been declared as problematic. This vulnerability affects unknown code of the file /interface/message-iframe of the component HTML Sanitizer. Such manipulation leads to HTML injection. This vulnerability is documented as CVE-2026-104083. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in SmarterTools SmarterMail. Affected by this issue is some unknown processing of the file /interface/message-iframe of the component HTML Sanitizer. The manipulation with an unknown input leads to a html injection vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy.

The advisory is available at smartertools.com. This vulnerability is handled as CVE-2026-104083 since 10/01/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

Upgrading to version 9777 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• SmarterTools

Name

• SmarterMail

Version

• 1.6.1511
• 1.6.1529
• 4.3
• 5.0.2999
• 7.1.3876
• 9.2
• 13.3.5535
• 16.x Build 8747
• 100.0.7803
• 100.0.9511
• 100.0.9518
• 100.0.9610
• 7776
• 9526
• 9560

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion